PT-2026-33115 · Weblateorg · Weblate

Published 2026-04-15 · Updated 2026-04-15 · CVE-2026-33220

NVD

CVSS v3.1

6.8

Medium

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't perform proper access control. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable this feature as the CDN add-on is not enabled by default.

Fix

Path traversal

Information Disclosure

Weakness Enumeration

CWE-22

CWE-200

Related Identifiers

CVE-2026-33220

Affected Products

Weblate

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-33220 · Security Note
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-mqph-7h49-hqfm · Note
• https://github.com/WeblateOrg/weblate/pull/18516 · Note